AI Recovery

AI recovery

The next AI milestone is a durable recovery workflow: inspect an unhealthy module, approve a restart, and verify the replacement using runtime evidence.

Implementation was merged in PR #39, tracked by issue #38 on the server roadmap. Merged to main on October 13, 2026 at commit c9748fc. This is not yet a published binary release.

The implementation supports /recover application/module, a defined model tool, and the existing Tasks/Approvals sidebar. Records and pending approvals survive reconnects for the original administrator identity. The controller requires current permission, an unexpired approval and the expected module generation. It reports recovery only when a successful operation receipt matches the healthy running replacement.

Uncertain operations are not replayed after interruption. Read-only reconciliation checks the receipt and current health. The scope is approved restart, with four concurrent recovery workers and bounded history; distributed scheduling and new provider adapters remain separate milestones.

Local macOS arm64 validation passed 112 tests, the real SSH recovery fixture, identity authorization tests and existing server integration. Hosted macOS arm64, Linux server, Linux resource enforcement and secret scanning all passed for the final PR revision. The recovery fixture independently checks HTTP responses and avoids DNS lookups at startup. No running installation was upgraded by this work.

See the operator guide for commands, recovery states and crash-window limits.